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- The MAILING DATE of this communication appears on the cover sheet with the correspondence address — 
Period for Reply 



A SHORTENED STATUTORY PERIOD FOR REPLY IS SET TO EXPIRE 3 MONTH(S) OR THIRTY (30) DAYS, 
WHICHEVER IS LONGER, FROM THE MAILING DATE OF THIS COMMUNICATION. 

- Extensions of time may be available under the provisions of 37 CFR 1 .136(a). In no event, however, may a reply be timely filed 
after SIX (6) MONTHS from the mailing date of this communication. 

- If NO period for reply is specified above, the maximum statutory period will apply and will expire SIX (6) MONTHS from the mailing date of this communication. 

- Failure to reply within the set or extended period for reply will, by statute, cause the application to become ABANDONED (35 U.S.C. § 133). 
Any reply received by the Office later than three months after the mailing date of this communication, even if timely filed, may reduce any 
earned patent term adjustment. See 37 CFR 1 .704(b). 

Status 

1 )^| Responsive to communication(s) filed on 06 September 2006 . 
2a )□ This action is FINAL. 2b)£3 This action is non-final. 

3) D Since this application is in condition for allowance except for formal matters, prosecution as to the merits is 

closed in accordance with the practice under Ex parte Quayle, 1935 CD. 11, 453 O.G. 213. 

Disposition of Claims 

4) ^3 Claim(s) 1-26 is/are pending in the application. 

4a) Of the above claim(s) is/are withdrawn from consideration. 

5) D Claim(s) is/are allowed. 

6) |EI Claim(s) 1-26 is/are rejected. 

7) D Claim(s) is/are objected to. 

8) D Claim(s) are subject to restriction and/or election requirement. 

Application Papers 

9) IZI The specification is objected to by the Examiner. 

10)D The drawing(s) filed on is/are: a)^ accepted or b)^ objected to by the Examiner. 

Applicant may not request that any objection to the drawing(s) be held in abeyance. See 37 CFR 1.85(a). 
Replacement drawing sheet(s) including the correction is required if the drawing(s) is objected to. See 37 CFR 1.121(d). 
The oath or declaration is objected to by the Examiner. Note the attached Office Action or form PTO-152. 

Priority under 35 U.S.C. § 119 

12)D Acknowledgment is made of a claim for foreign priority under 35 U.S.C. § 119(a)-(d) or (f). 
a)D All b)D Some * c)D None of: 

1 0 Certified copies of the priority documents have been received. 

20 Certified copies of the priority documents have been received in Application No. . 

3.Q Copies of the certified copies of the priority documents have been received in this National Stage 
application from the International Bureau (PCT Rule 17.2(a)). 
* See the attached detailed Office action for a list of the certified copies not received. 
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1) ^| Notice of References Cited (PTO-892) 4) □ Interview Summary (PTO-41 3) 

2) □ Notice of Draftsperson's Patent Drawing Review (PTO-948) Paper No(s)/Mail Date. . 

3) □ Information Disclosure Statement(s) (PTO/SB/08) 5 ) □ Notice of Informal Patent Application 

Paper No(s)/Mail Date . 6) □ Other: . 
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DETAILED ACTION 

1. Claims 1-26 are pending. 

2. Pre-Appeal Brief request filed 09/06/2006 has been received 
and considered. Prosecution is hereby reopened. 

Claim Rejections - 35 USC §101 

3. 35 U.S.C. 101 reads as follows: 

Whoever invents or discovers any new and useful process, machine, 
manufacture, or composition of matter, or any new and useful improvement 
thereof, may obtain a patent therefor, subject to the conditions and 
requirements of this title. 

4. Claim 15 is rejected under 35 U.S.C. 101 because the 
claimed invention is directed to non-statutory subject matter. 
Claim 15 relates to a computer signal embodied on a transmission 
medium which is non-statutory. The transmission medium lacks 
the necessary physical articles or objects to constitute a 
machine or a manufacture within the mean of 35 USC §101. It is 
clearly not a series of steps or acts to be a process nor is it 
a combination of chemical compounds to be a composition of 
matter. As such, it fails to fall within a statutory category. 
It is, at best, functional descriptive material per se. 
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Claim Rejections - 35 USC §103 

5. The following is a quotation of 35 U.S.C. 103(a) which 
forms the basis for all obviousness rejections set forth in this 
Office action: 

(a) A patent may not be obtained though the invention is not identically 
disclosed or described as set forth in section 102 of this title, if the 
differences between the subject matter sought to be patented and the prior 
art are such that the subject matter as a whole would have been obvious at 
the time the invention was made to a person having ordinary skill in the 
art to which said subject matter pertains. Patentability shall not be 
negatived by the manner in which the invention was made. 

6. Claims 1, 7, 8, 10-16, 22-26 are rejected under 35 
U.S.C. 103(a) as being unpatentable over Chess et al . (US 
6711583) in view of Yamamoto (US 5881151) . 

As per claims 1, 13-16, and 24, Chess et al . discloses 
preparing language description data corresponding to at least 
one script language; preparing detection data for viral code 
corresponding to the script language virus; and analyzing a data 
stream using the language description data and the detection 
data to detect the viral code (see column 4 lines 22-61 where a 
macro is a script and the system must have language description 
data to prepare the detection data which is the data stored in 
database 204) . 

Chess et al . fails to explicitly disclose the use of 
lexical analysis as part of the virus detection. 
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However, Yamamoto teaches the use of lexical analysis in 
the detection of viruses (see column 4 line 47 through column 5 
line 3) . 

At the time of the invention it would have been obvious to 
a person of ordinary skill in the art to use lexical analysis to 
find the viruses in the Chess et al . system. 

Motivation to do so would have been to be able to check the 
validity of all vocabulary words of the source program (see 
Yamamoto column 4 lines 59-67) . 

As per claim 7, the modified Chess et al . and Yamamoto 
system discloses setting definition rules for each of the at 
least one script language (see Chess et al . column 4 lines 22- 
61) . 

As per claims 8, 22, 25, and 26, the modified Chess et al . 
and Yamamoto system discloses the detection data comprise at 
least one test wherein each of the at least one test correspond 
to a pattern match or a CRC check (see Chess et al . column 4 
lines 22-61) . 

As per claims 10-12 and 23, the modified Chess et al . and 
Yamamoto system discloses converting the data stream to a stream 
of tokens using lexical analysis that correspond to respective 
language constructs (see Yamamoto column 4 line 47 through 
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column 5 line 3) and performing a CRC to detect viral code (see 
Chess et al . column 4 lines 22-61) . 

7. Claims 2, 3, 17, and 18 are rejected under 35 U.S.C. 103(a) 
as being unpatentable over the modified Chess et al . and 
Yamamoto system as applied to claims 1 and 16 above, and further 
in view of Session (Session 19: Intro to Compiler Design). 

As per claims 2, 3, 17, and 18, the modified Chess et al . 
and Yamamoto system fails to explicitly disclose that the 
language description data are dynamic finite automata. 

However, Session teaches the well-known concept in the art 
that lexical analysis may rely on dynamic finite automata in 
order to recognize tokens in a language. Furthermore, the 
dynamic finite automata may be used to construct string 
matchers . 

At the time of the invention it would have been obvious to 
a person of ordinary skill in the art to use the dynamic finite 
automata in the modified Chess et al . and Yamamoto system. 

Motivation to do so would have been that it provides an 
efficient means for recognizing tokens and constructing string 
matches . 

8. Claims 4-6 and 19-21 are rejected under 35 U.S.C. 103(a) as 
being unpatentable over the modified Chess et al . and Yamamoto 
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system as applied to claims 1 and 16 above, and further in view 
of Raduchel et al . (US 6418444). 

As per claims 4-6 and 19-21, the modified Chess et al . and 
Yamamoto system fails to explicitly disclose that the 
description data correspond to language definition rules and 
check rules wherein the language definition rules include 
description of constructs of the target script language and 
relationships between the constructs. 

However, Raduchel et al . teaches such rule checking (see 
column 13 lines 4-43) . 

At the time of the invention it would have been obvious to 
a person of ordinary skill in the art to include the language 
checks of Raduchel et al . in the modified Chess et al . and 
Yamamoto system. 

Motivation to do so would have been prevent programs that 
can pose risks to a computer system because they do not conform 
to the language standard (see column 1 lines 39-52) . 
9. Claim 9 is rejected under 35 U.S.C. 103(a) as being 
unpatentable over the modified Chess et al . and Yamamoto system 
as applied to claim 1 above, and further in view of Bernhard et 
al. (US 6609205) . 

As per claim 9, the modified Chess et al . and Yamamoto 
system fails to explicitly disclose obtaining samples of viral 
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code; analyzing the obtained samples; and setting a detection 
regimen that includes at least one pattern match or CRC check 
based on the analysis of the obtained samples. 

However, Bernhard et al . teaches such steps (see column 2 
lines 14-28) . 

At the time of the invention it would have been obvious to 
a person of ordinary skill in the art to additionally use the 
methods of Bernhard et al . in the modified Chess et al . and 
Yamamoto system. 

Motivation to do so would have been to consolidate the 
reference signatures (see column 2 lines 34-45) . 

Response to Arguments 

10. Applicant's arguments with respect to claims 1-26 have been 
considered but are moot in view of the new ground (s) of 

re j ection . 

Conclusion 

11. The prior art made of record and not relied upon is 
considered pertinent to applicant's disclosure. Bates, Kephart, 
Chi, and Ogilvie teach methods of detecting viruses similar to 
the claimed invention. 
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Any inquiry concerning this communication or earlier 
communications from the examiner should be directed to MICHAEL 
PYZOCHA whose telephone number is (571)272-3875. The examiner 
can normally be reached on 7:00am - 4:30pm first Fridays of the 
bi-week off. 

If attempts to reach the examiner by telephone are 
unsuccessful, the examiner's supervisor, Emmanuel Moise can be 
reached on (571) 272-3865. The fax phone number for the 
organization where this application or proceeding is assigned is 
571-273-8300. 

Information regarding the status of an application may be 
obtained from the Patent Application Information Retrieval 

(PAIR) system. Status information for published applications 
may be obtained from either Private PAIR or Public PAIR. Status 
information for unpublished applications is available through 
Private PAIR only. For more information about the PAIR system, 
see http://pair-direct.uspto.gov. Should you have questions on 
access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free) . If you would 
like assistance from a USPTO Customer Service Representative or 
access to the automated information system, call 800-786-9199 

(IN USA OR CANADA) or 571-272-1000. 
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/Emmanuel L. Moise/ 

Supervisory Patent Examiner, Art Unit 2137 



